# Security Policy

## Reporting a Vulnerability

We take security seriously. If you discover a security vulnerability, please report it responsibly.

**Please do NOT report security vulnerabilities through public issues.**

### How to Report

Email: hello@fromaitochitta.com

Include:
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Any suggested fixes (optional)

### What to Expect

- Acknowledgment within 48 hours
- Regular updates on progress
- Credit in the fix announcement (if desired)

## Supported Versions

Support follows the tags, not a calendar, and the table is deliberately version-free — a release
number written here would drift the moment the next tag lands.

| Version | Security fixes | What that means |
| ------- | -------------- | --------------- |
| Newest tagged release | :white_check_mark: best-effort | Fixes land on `main` and ship in the next tag |
| Every earlier tag | :x: | Earlier tags are never re-released. Upgrade, or fork and patch |

There is no long-term-support branch and no backporting. One maintainer, best-effort.

## Deprecation Notice Period

When a supported surface is removed, or a dependency stops receiving security fixes:

- The deprecation is announced in [`CHANGELOG.md`](CHANGELOG.md) under the release that introduces
  it, and repeated in the release notes on the forge.
- **At least one minor release — and no fewer than 30 days — passes between that announcement and
  the removal**, so anyone reading the changelog has a version to move to before the old one goes.
- **The stated exception is a security-critical removal.** If leaving a surface in place is itself
  the risk, it goes in the next release and the changelog says plainly why the notice period was
  not used. This has not happened so far.

This is a notice period, not an SLA. See the
[organisation governance](https://git.fromaitochitta.com/open/repo-standard/src/branch/main/GOVERNANCE.md)
for what this project does and does not promise.

## Security Best Practices

When using portfolio-optimiser:
- Keep dependencies updated
- Use environment variables for sensitive configuration — never commit secrets
- Prefer the local-only backend profile; the framework makes no silent network egress
- Follow the principle of least privilege for any data-source credentials

## Scope Note

portfolio-optimiser is a **technical framework**. Deploying organizations own their own data
protection, risk, and compliance assessments (DPIA/ROS). The framework ships technical
prerequisites (local-only mode, provenance, no silent egress) but makes no compliance guarantees.